Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
«We protect your website» – No you don`t
1. “We protect you applications”!
“No, you don’t”
Digicomp Hacking Day 2013
May 16th 2013
2. Sven Vetsch
§ Partner & CTO at Redguard AG
§ www.redguard.ch
§ Specialized in Application Security
§ (Web, Web-Services, Mobile, …)
§ Leader OWASP Switzerland
§ www.owasp.org / www.owasp.ch
sven.vetsch@redguard.ch
Twitter: @disenchant_ch / @redguard_ch
3. Sven Vetsch
§ Partner & CTO at Redguard AG
§ www.redguard.ch
§ Specialized in Application Security
§ (Web, Web-Services, Mobile, …)
§ Leader OWASP Switzerland
§ www.owasp.org / www.owasp.ch
sven.vetsch@redguard.ch
Twitter: @disenchant_ch / @redguard_ch
4. Disclaimer
This presentation is focused on classic WAF
functionality so we won’t get into Single-Sign-
On, Content Injection and so on.
All the views in this presentation are my own
and not necessarily those of Redguard AG.
9. 23%
already experienced a data or
system breach as a result of an
application layer vulnerability
WhiteHat Security – Website Security Statistics Report May 2013
10. … only 29% in banking
55.6%
of all organizations use WAFs
WhiteHat Security – Website Security Statistics Report May 2013
11. WAF Deployment by Industry
WhiteHat Security – Website Security Statistics Report May 2013
29
30
17
30
32
30
50
20
12
10
10
8
43
30
17
30
36
29
17
10
12
Banking
Financial Services
Healthcare
Retail
Technology
Monitoring and actively blocking attacks
Currently only monitoring traffic
Installing and/or configuration mode
No WAF deployed
Don't know
12. WAF usage after a breach
38%
19%
6%
6%
31%
Monitoring and actively blocking attacks
Currently only monitoring traffic
Installing and/or configuration mode
Don't know
No WAF deployed
WhiteHat Security – Website Security Statistics Report May 2013
13. 62%
of attacks can be blocked
by a WAF with default rule sets
NT OBJECTives - Analyzing the Effectiveness of Web Application Firewalls 2011
14. Organizations with a
Web Application Firewall
deployed had
11% more vulnerabilities,
resolved them 8% slower,
and had a
7% lower remediation rate.
WhiteHat Security – Website Security Statistics Report May 2013
16. § Possible reasons:
§ Insufficient global security processes
§ Rules are not sufficient
§ Not enough resources to manage the WAF
§ WAFs are threated as if they could solve all
problem
§ WAFs are only in monitoring mode instead of
blocking anything
§ …
19. By summing all these percentages up
we could safely say that a WAF could
feasible help mitigate the risk of at
least
71%
of all custom web application
vulnerabilities
WhiteHat Security – Website Security Statistics Report May 2012
21. 12 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
21
Vendor Supplied Certificate
“[Product] guarantees security of web
applications.”
22. 12 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
22
Vendor Supplied Certificate
“The [Company] Web Application Firewall
quickly protects web servers from data
breaches and websites from defacement
without administrators waiting for clean code
or even knowing how an application works.”
23. 12 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
23
Vendor Supplied Certificate
“Fully addresses PCI 6.6”
24. 15 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
24
Vendor Supplied Certificate
“Fully addresses PCI 6.6”
Data Security Standard v2
6.6 For public-facing web applications, address new threats and
vulnerabilities on an ongoing basis and ensure these applications are
protected against known attacks by either of the following methods:
• Reviewing public-facing web applications via manual or automated
application vulnerability security assessment tools or methods, at
least annually and after any changes
• Installing a web-application firewall in front of public-facing web
applications
25. 12 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
25
Vendor Supplied Certificate
“Because of its unique blend of HTML and XML
security, the [Company] Web Application Firewall
provides a full compliance solution for the PCI
DSS sections 6.5 and 6.6, which mandate the
implementation of a Web application firewall by
June 30, 2008.”
26. 15 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
26
Vendor Supplied Certificate
“Because of its unique blend of HTML and XML
security, the [Company] Web Application Firewall
provides a full compliance solution for the PCI
DSS sections 6.5 and 6.6, which mandate the
implementation of a Web application firewall by
June 30, 2008.”
Data Security Standard v2
6.5 Develop applications based on secure coding guidelines. Prevent
common coding vulnerabilities in software development processes, to
include the following: [OWASP Top 10]
27. 15 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
27
Vendor Supplied Certificate
The [Product] offers you the following
technical features:
• ...
• Session fixation
• …
28. 12 May 2013
Redguard AG | Sven Vetsch | sven.vetsch@redguard.ch
28
Vendor Supplied Certificate
The [Product] offers you the following
technical features:
• ...
• Session fixation
• …
30. Insecure Rules
§ Let’s take the following pseudo rule:
if ($path == "/admin") {
if ($ipaddr == $internal_ipaddr)
[block request]
else
[allow request]
}
45. … my experience would
be more around 50%
11.2%
of all application are vulnerable
to CSRF attacks
WhiteHat Security – Website Security Statistics Report May 2013
47. HTTP Parameter Pollution (HPP)
http://www.example.com/?id=1&id=2
Technology
Behavior
Result
ASP
/
ASP.NET
ConcatenaJon
id=1,2
PHP
Last
occurrence
id=2
Java
First
occurrence
id=1
48. HTTP Parameter Pollution (HPP)
§ Let’s have a look at the following simple
pseudo rule against SQL Injection attacks:
if $param_id.match(/.*select.*from.*/)
[block request]
52. More things your WAF isn’t good at
§ Anti-Automation and process validation
§ Understanding application logic
§ Insufficient Authentication & Authorization
§ Brute Force Attacks
§ Session Fixation
§ Anomaly Detection
§ Improper Filesystem Permissions
§ Securing client side running code
§ …
53. Hacking a WAF (for fun and profit)
§ In the past, WAFs also suffered from
vulnerabilities like:
§ Filter Bypasses (a lot of them!!!)
§ XSS in their web admin interface
§ CSRF in their web admin interface
§ Default SSH root passwords
§ Information Disclosure about the LAN/DMZ
§ Arbitrary remote command execution
§ XML External Entity (XXE) Attacks
54. Hacking a WAF (for fun and profit)
Example scenario based on ModSecurity
XML External Entity (XXE) vulnerability
CVE-2013-1915
56. Hacking a WAF (for fun and profit)
/etc/apache2/ssl/cert.pem
WAF
57. Hacking a WAF (for fun and profit)
Request:
Response:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/apache2/ssl/cert.pem"
>]><foo>&xxe;</foo>
60. Conclusion
WAFs …
§ are good – at least they can help you
§ must be tuned by a trained professional
§ can’t compensate insecure code
§ aren’t an alternative to patching vulnerabilities
§ can generate a lot of profit for vendors so be
careful about what features you really need
and how well they perform
§ don’t solve all your appsec problems
61. We should accept WAFs for what
they really are: a method of
increasing the cost of attacks, but
not necessarily one that might
repel every attacker.
Ivan Ristic